&EPA
United States
Environmental Protection
Agency
Response Protocol Toolbox:
Planning for and Responding to
Drinking Water Contamination
Threats and Incidents
Interim Final - August 2004
Response Guidelines
-------
Response Protocol Toolbox:
Planning for and Responding to
Drinking Water Contamination Threats and Incidents
Response Guidelines
Interim Final - August 2004
PLANNING AND PREPARATION
Threat Warning
Initial Threat Evaluation
Immediate Operational
Response Actions
Site Characterization and
Sampling
Public Health Response
Actions
Sample Analysis
Is Incident
Confirmed?
Remediation and Recovery
-------
RESPONSE GUIDELINES
TABLE OF CONTENTS
INTRODUCTION 3
1 COMMUNICATIONS AND NOTIFICATIONS 4
1.1 INITIAL NOTIFICATIONS 4
1.2 CONTACT LIST 5
2 THREAT EVALUATION 6
2.1 THREAT EVALUATION PROCESS 6
2.2 EVALUATING THREAT WARNINGS 7
2.3 THREAT EVALUATION WORKSHEET 8
2.4 SECURITY INCIDENT REPORT FORM 13
2.5 WITNESS ACCOUNT REPORT FORM 16
2.6 PHONE THREAT REPORT FORM 20
2.7 WRITTEN THREAT REPORT FORM 23
2.8 WATER QUALITY/CONSUMER COMPLAINT REPORT FORM 26
2.9 PUBLIC HEALTH INFORMATION REPORT FORM 28
3 SITE CHARACTERIZATION AND SAMPLING 30
3.1 SITE CHARACTERIZATION PROCESS 30
3.2 EMERGENCY WATER SAMPLE COLLECTION KIT 31
3.3 SAMPLE CONTAINERS 32
3.4 SAMPLE COLLECTION GUIDELINES 34
3.4.1 Safety Guidelines 34
3.4.2 Sampling Procedures 34
3.4.3 Sample Holding 55
3.4.4 Sample Transport 55
3.5 SITE CHARACTERIZATION PLAN TEMPLATE 36
3.6 SITE CHARACTERIZATION REPORT FORM 40
3.7 FIELD TESTING RESULTS FORM 45
3.8 SAMPLE DOCUMENTATION FORM 46
3.9 CHAIN OF CUSTODY FORM 47
4 SAMPLE ANALYSIS 48
4.1 LABORATORY CONTACT LIST 48
4.2 GENERAL APPROACH FOR ANALYSIS OF UNKNOWNS IN WATER 49
4.3 GENERAL CLASSES OF CHEMICALS, ANALYTE GROUPS, AND EXAMPLE CONTAMINANTS 50
4.4 GENERAL CLASSES OF PATHOGENS, SPECIFIC ORGANISMS, AND SELECT AGENT STATUS 50
5 RESPONSE ACTIONS 51
5.1 DECISION TREE FOR CONTAINMENT OPTIONS 51
5.2 DECISION TREE FOR PUBLIC NOTIFICATION 52
5.3 CONTAMINANT CHARACTERIZATION AND TRANSPORT WORKSHEET 53
5.4 PUBLIC HEALTH RESPONSE ACTION WORKSHEET 59
6 APPENDICES 63
6.1 CRITICAL SYSTEM INFORMATION CHECKLIST 63
6.2 INFORMATION RESOURCES 64
6.3 THREAT MANAGEMENT MATRICES 65
6.3.1 Security Breach 65
6.3.2 Witness Account 67
6.3.3 Direct Notification by Perpetrator 68
6.3.4 Unusual Water Quality or Consumer Complaints 70
6.3.5 Notification by Public Health 72
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Introduction
The EPA released the interim final Response Protocol Toolbox: Planning for and Responding to
Drinking Water Contamination Threats and Incidents (the Response Protocol Toolbox) in winter
of 2003 and spring of 2004 to help the water sector effectively and appropriately plan for and
respond to contamination threats and incidents. Since its release, EPA has received feedback and
suggestions from several sources concerning improvements in the Response Protocol Toolbox.
These Response Guidelines have been developed to provide an easy to use document for field
and crisis conditions. While the Response Protocol Toolbox provides detailed information, the
Response Guidelines are to be viewed as the application of the same principles during an actual
incident.
As stated in the definition of Response Guidelines in Module 1, Section 4.3 of the Response
Protocol Toolbox, Response Guidelines are different from an Emergency Response Plan in that
they are essentially a "field guide" for responding to contamination threats and can be developed
in many different formats.
This document is intended to be an action oriented document to assist drinking water utilities,
laboratories, emergency responders, state drinking water programs, technical assistance
providers, and public health and law enforcement officials during the management of an ongoing
contamination threat or incident. The Response Guidelines are derived from the content of the
six full modules of the Response Protocol Toolbox.
The Response Guidelines are not intended to replace the Response Protocol Toolbox and they do
not contain the detailed information contained within the six complete modules. Finally, users
are encouraged to adapt the Response Guidelines as necessary to meet their own needs and
objectives.
Interim Final - August 2004
-------
RESPONSE GUIDELINES
1 Communications and Notifications
1.1 Initial Notifications
'Possible' stage evaluation by utility
'Credible' stage evaluation by utility
24/7 Call Center
xxx-xxx-xxxx
WUERM
xxx-xxx-xxxx (home)
xxx-xxx-xxxx (cell)
wuerm@xxx.xxx (text messenger)
formation Officer
rom water utility
xxx-xxx-xxxx
Utility Head
xxx-xxx-xxxx
Safety Officer
from water utility
xxx-xxx-xxxx
Utility Operations
Chief
xxx-xxx-xxxx
WUERM
xxx-xxx-xxxx (home)
xxx-xxx-xxxx (cell)
wuerm@xxx.xxx (text messenger)
'Credible' stage evaluation by unified command
'Confirmed' stage evaluation by unified command
Agency Representative from Utility (WUERM)
xxx-xxx-xxxx (home)
xxx-xxx-xxxx (cell)
wuerm@xxx.xxx (text messenger)
Utility Plant Operator
xxx-xxx-xxxx
-
Laboratory PoC
xxx-xxx-xxxx
1
SCADACoordinaor
xxx-xxx-xxxx
Unit Operator
L
Section Heads
xxx-xxx-xxxx
1
Agency Representative from Utility (WUERM)
xxx-xxx-xxxx (home)
xxx-xxx-xxxx (cell)
wuerm@xxx.xxx {text messenger)
Technical Specialists
{Water Utility)
Water Utility Emergency Operations Center (WUEOCM)
xxx-xxx-xxxx {home)
xxx-xxx-xxxx {cell)
wuerm@xxx.xxx {text messenger)
Utility Plant Operator
xxx-xxx-xxxx
-
Laboratory PoC
xxx-xxx-xxxx
1
SCADA Coordinator
xxx-xxx-xxxx
Unit Operator
xxx-xxx-xxxx
L
Section Heads
xxx-xxx-xxxx
|_ Key Person ne
xxx-xxx-xxxx
Maintenance Head
xxx-xxx-xxxx
-
Key Personnel
xxx-xxx-xxxx
Public Works Interface
xxx-xxx-xxxx
Interim Final - August 2004
-------
RESPONSE GUIDELINES
1.2 Contact List
TO BE COMPLETED
Agency
Name
Location
Phone
E-mail
Interim Final - August 2004
-------
RESPONSE GUIDELINES
2 Threat Evaluation
2.1 Threat Evaluation Process
NO-
Review existing information
Perform site characterization
Review additional information
Consider operational response
YES
Close investigation, return \
to normal operation, and I
document the threat. J
[
nple analysis
Consider public health response
Review additional information
o results confirm
contamination?
YES
I
Revise operational and public
health response as necessary
I
YES
i
Revise sampling and
analysis plans and continue
threat evaluation
Develop remediation
and recovery plan
Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.2 Evaluating Threat Warnings
The first critical step in evaluating a contamination threat is recognition of a threat warning (i.e.,
an unusual situation that may have presented the opportunity for contamination of the drinking
water). The utility will likely be in the best position to observe a threat warning and evaluate
whether or not the activity is suspicious (i.e., first decision point in the Threat Evaluation
process). This section briefly describes factors to consider when evaluating various types of
threat warnings.
The common types of threat warnings include:
Security breaches: A security breach is an unauthorized intrusion into a secured facility
that may be discovered through direct observation, an alarm trigger, or signs of intrusion
(e.g., cut locks, open doors, cut fences). Security breaches may be the most common
threat warnings, but in most cases are related to day-to-day operation and maintenance
within the water system. Other security breaches may be due to criminal activity such as
trespassing, vandalism, and theft rather than attempts to contaminate the water.
o Security Incident Report Form > Section 2.4
Witness account: A threat warning may come from an individual who directly witnesses
suspicious activity, such as trespassing, breaking and entering, or some other form of
tampering. The witness could be a utility employee, law enforcement officer, citizen, etc.
o Witness Account Report Form > Section 2.5
Direct notification by perpetrator: A threat may be made directly, verbally or in
writing, to the water utility, the news media, law enforcement, or a government agency.
Verbal threats made over the phone are historically the most common type of direct
threats from perpetrators; however, there have also been written threats to contaminate
the drinking water supply.
o Phone Threat Report Form > Section 2.6
o Written Threat Report Form > Section 2.7
Unusual water quality or consumer complaints: Unusual water quality results or an
unexplained or unusually high incidence of consumer complaints may serve as a warning
of potential contamination. In order to evaluate this type of warning, it will be necessary
to carefully track routinely monitored water quality data and/or consumer complaints
such that significant deviations from an established baseline might be observed.
oD Water Quality and Consumer Complaints Report Form > Section 2.8
Notification by public health agency: Notification from a public health agency
regarding increased incidence of disease or death is another possible threat warning. A
threat triggered by a public health notification is unique in that at least a segment of the
population has presumably been exposed to a harmful substance. In this case, public
health officials may launch an epidemiological investigation in an attempt to identify the
source of the outbreak, during which the utility may be expected to play a support role.
o Public Health Information Report Form > Section 2.9
Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.3 Threat Evaluation Worksheet
INSTRUCTIONS
The purpose of this worksheet is to help organize information about a contamination threat warning that
would be used during the Threat Evaluation Process. The individual responsible for conducting the
Threat Evaluation (e.g., the WUERM) should complete this worksheet. The worksheet is generic to
accommodate information from different types of threat warnings; thus, there will likely be information that
is unavailable or not immediately available. Other forms in the Appendices are provided to augment the
information in this worksheet.
THREAT WARNING INFORMATION
Date/Time threat warning discovered:
Utility Name and Address:
Name/Number of person who discovered threat warning:
Type of threat warning:
D Security breach D Witness account D Phone threat
D Written threat D Unusual water quality D Consumer complaints
D Public health notification D Other
Identity of the contaminant: D Known D Suspected D Unknown
If known or suspected, provide additional detail below
D Chemical D Biological D Radiological
Describe
Time of contamination: D Known D Estimated D Unknown
If known or estimated, provide additional detail below
Date and time of contamination:
Additional Information:
Mode of contamination: D Known D Suspected D Unknown
If known or suspected, provide additional detail below
Method of addition: D Single dose D Overtime D Other
Amount of material:
Additional Information:
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Site of contamination: D Known D Suspected
If known or suspected, provide additional detail below
Number of sites:
D Unknown
Provide the following information for each site.
Site #1
Site Name:
Type of facility
D Source water
D Ground storage tank
D Distribution main
D Other
Address:
D Treatment plant
D Elevated storage tank
D Hydrant
D Pump station
D Finished water reservoir
D Service connection
Additional Site Information:
Site #2
Site Name:
Type of facility
D Source water
D Ground storage tank
D Distribution main
D Other
Address:
D Treatment plant
D Elevated storage tank
D Hydrant
D Pump station
D Finished water reservoir
D Service connection
Additional Site Information:
Site #3
Site Name:
Type of facility
D Source water
D Ground storage tank
D Distribution main
D Other
Address:
D Treatment plant
D Elevated storage tank
D Hydrant
D Pump station
D Finished water reservoir
D Service connection
Additional Site Information:
Interim Final - August 2004
-------
RESPONSE GUIDELINES
ADDITIONAL INFORMATION
Has there been a breach of security at the suspected site? D Yes D No
If "Yes", review the completed 'Security Incident Report' (Section 2.4)
Are there any witness accounts of the suspected incident? D Yes D No
If "Yes", review the completed Witness Account Report' (Section 2.5)
Was the threat made verbally over the phone? D Yes D No
If "Yes", review the completed 'Phone Threat Report' (Section 2.6)
Was a written threat received? D Yes D No
If "Yes", review the completed 'Written Threat Report' (Section 2.7)
Are there unusual water quality data or consumer complaints? D Yes D No
If "Yes", review the completed 'Water Quality/Consumer Complaint Report' (Section 2.8)
Are there unusual symptoms or disease in the population? D Yes D No
If "Yes", review the completed 'Public Health Report' (Section 2.9)
Is a 'Site Characterization Report' available? D Yes D No
If "Yes", review the completed 'Site Characterization Report' (Section 3.4)
Are results of sample analysis available? D Yes D No
If "Yes", review the analytical results report, including appropriate QA/QC data
Is a 'Contaminant Identification Report' available? D Yes D No
If "Yes", review the completed 'Sample Analysis Report' (Section 4.3)
Is there relevant information available from external sources? D Yes D No
Check all that apply
D Local law enforcement D FBI D DW primacy agency
D Public health agency D Hospitals/911 call centers D US EPA/Water ISAC
D Media reports D Homeland security alerts D Neighboring utilities
D Other
Point of Contact:
Summary of key information from external sources (provide detail in attachments as necessary):
10 Interim Final - August 2004
-------
RESPONSE GUIDELINES
THREAT EVALUATION
Has normal activity been investigated as the cause of the threat warning? D Yes D No
Normal activities to consider
D Utility staff inspections D Routine water quality sampling
D Construction or maintenance D Contractor activity
D Operational changes D Water quality changes with a known cause
D Other
Is the threat 'possible'? D Yes D No
Summarize the basis for this determination:
Response to a 'possible' threat:
D None D Site characterization
D Increased monitoring/security D Other
D Isolation/containment
Is the threat'credible'? D Yes D No
Summarize the basis for this determination:
Response to a 'credible' threat:
D Sample analysis D Site characterization
D Partial EOC activation D Public notification
D Other
D Isolation/containment
D Provide alternate water supply
Has a contamination incident been confirmed?
Summarize the basis for this determination:
D Yes
D No
Response to a confirmed incident:
D Sample analysis D Site characterization
D Full EOC activation D Public notification
D Initiate remediation and recovery
D Other
D Isolation/containment
D Provide alternate water supply
11
Interim Final - August 2004
-------
RESPONSE GUIDELINES
How do other organizations characterize the threat?
Organization
n Local Law
Enforcement
D FBI
D Public Health
Agency
D Drinking Water
Primacy Agency
D Other
D Other
Evaluation
EJ Possible
fj Credible
n Confirmed
EJ Possible
O Credible
n Confirmed
EJ Possible
fj Credible
n Confirmed
|_| Possible
O Credible
O Confirmed
O Possible
O Credible
O Confirmed
O Possible
O Credible
O Confirmed
Comment
SIGNOFF
Name of person completing this form:
Print name
Signature
Phone Number
Date/Time:
12
Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.4 Security Incident Report Form
INSTRUCTIONS
The purpose of this form is to help organize information about a security incident, typically a security
breach, which may be related to a water contamination threat. The individual who discovered the security
incident, such as a security supervisor, the WUERM, or another designated individual may complete this
form. This form is intended to summarize information about a security breach that may be relevant to the
threat evaluation process. This form should be completed for each location where a security incident was
discovered.
DISCOVERY OF SECURITY INCIDENT
Date/Time security incident discovered:
Name of person who discovered security incident:
Mode of discovery:
D Alarm (building)
D Video surveillance
D Suspect confession
D Other
D Alarm (gate/fence) D
D Utility staff discovery D
D Law enforcement discovery
Alarm (access hatch)
Citizen discovery
Did anyone observe the security incident as it occurred?
If "Yes", complete the Witness Account Report' (Appendix 8.4)
D Yes
D No
SITE DESCRIPTION
Site Name:
Type of facility
D Source water
D Ground storage tank
Distribution main
Other
D
D
Address:
D Treatment plant
D Elevated storage tank
D Hydrant
D Pump station
D Finished water reservoir
D Service connection
Additional Site Information:
BACKGROUND INFORMATION
Have the following "normal activities" been investigated as potential causes of the security
incident?
D Alarms with known and harmless causes D Utility staff inspections
D Routine water quality sampling D Construction or maintenance
D Contractor activity D Other
13
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Was this site recently visited prior to the security incident? D Yes D No
If "Yes," provide additional detail below
Date and time of previous visit:
Name of individual who visited the site:
Additional Information:
Has this location been the site of previous security incidents? D Yes D No
If "Yes," provide additional detail below
Date and time of most recent security incident:
Description of incident:
What were the results of the threat evaluation for this incident?
D 'Possible' D 'Credible' D 'Confirmed'
Have security incidents occurred at other locations recently? D Yes D No
If "Yes", complete additional 'Security Incident Reports' (Appendix 8.3) for each site
Name of 1st additional site:
Name of 2nd additional site:
Name of 3rd additional site:
SECURITY INCIDENT DETAILS
Was there an alarm(s) associated with the security incident? D Yes D No
If "Yes," provide additional detail below
Are there sequential alarms (e.g., alarm on a gate and a hatch)? D Yes D No
Date and time of alarm(s):
Describe alarm(s):
Is video surveillance available from the site of the security incident? D Yes D No
If "Yes," provide additional detail below
Date and time of video surveillance:
Describe surveillance:
14 Interim Final - August 2004
-------
RESPONSE GUIDELINES
Unusual equipment found at the site and time of discovery of the security incident:
D Discarded PPE (e.g., gloves, masks) D Empty containers (e.g., bottles, drums)
D Tools (e.g., wrenches, bolt cutters) D Hardware (e.g., valves, pipe)
D Lab equipment (e.g., beakers, tubing) D Pumps or hoses
D None D Other
Describe equipment:
Unusual vehicles found at the site and time of discovery of the security incident:
D Car/sedan D SUV D Pickup truck
D Flatbed truck D Construction vehicle D None
D Other
Describe vehicles (including make/model/year/color, license plate #, and logos or markings):
Signs of tampering at the site and time of discovery of the security incident:
D Cut locks/fences D Open/damaged gates, doors, or windows
D Open/damaged access hatches D Missing/damaged equipment
D Facility in disarray D None
D Other
Are there signs of sequential intrusion (e.g., locks removed from a gate and hatch)?
Describe signs of tampering:
D
D
Yes
No
Signs of hazard at the site and time of discovery of the security incident:
D Unexplained or unusual odors D Unexplained dead animals
D Unexplained dead or stressed vegetation D Unexplained liquids
D Unexplained clouds or vapors D None
D Other
Describe signs of hazard:
SIGNOFF
Name of person responsible for documenting the security incident:
Print name
Signature
Date/Time:
15
Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.5 Witness Account Report Form
INSTRUCTIONS
The purpose of this form is to document the observations of a witness to activities that might be
considered an incident warning. The individual interviewing the witness, or potentially the witness, should
complete this form. This may be the WUERM or an individual designated by incident command to
perform the interview. If law enforcement is conducting the interview (which may often be the case), then
this form may serve as a prompt for "utility relevant information" that should be pursued during the
interview. This form is intended to consolidate the details of the witness account that may be relevant to
the threat evaluation process. This form should be completed for each witness that is interviewed.
BASIC INFORMATION
Date/Time of interview:
Name of person interviewing the witness:
Witness contact information
Full Name:
Address:
Day-time phone:
Evening phone:
E-mail address:
Reason the witness was in the vicinity of the suspicious activity:
WITNESS ACCOUNT
Date/Time of activity:
Location of activity:
Site Name:
Type of facility
D Source water D Treatment plant D Pump station
D Ground storage tank D Elevated storage tank D Finished water reservoir
D Distribution main D Hydrant D Service connection
D Other
Address:
Additional Site Information:
16 Interim Final - August 2004
-------
Type of activity
D Trespassing
D Theft
D Other
D Vandalism
D Tampering
Additional description of the activity
RESPONSE GUIDELINES
D Breaking and entering
D Surveillance
Description of suspects
Were suspects present at the site?
How many suspects were present?
D Yes
D No
Describe each suspect's appearance:
Suspect #
1
2
3
4
5
6
Sex
Race
Hair color
Clothing
Voice
Where any of the suspects wearing uniforms?
If "Yes," describe the uniform(s):
D Yes
D No
Describe any other unusual characteristics of the suspects:
Did any of the suspects notice the witness?
If "Yes," how did they respond:
D Yes
D No
Vehicles at the site
Were vehicles present at the site? D Yes
Did the vehicles appear to belong to the suspects?
How many vehicles were present?
D No
D Yes
D No
17
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Describe each vehicle:
Vehicle #
1
2
3
4
5
6
Type
Color
Make
Model
License plate
Where there any logos or distinguishing markings on the vehicles?
If "Yes," describe:
D Yes
D No
Provide any additional detail about the vehicles and how they were used (if at all):
Equipment at the site
Was any unusual equipment present at the site?
D Explosive or incendiary devices
D PPE (e.g., gloves, masks)
D Tools (e.g., wrenches, bolt cutters)
D Lab equipment (e.g., beakers, tubing)
D Other
D Yes
D No
D Firearms
D Containers (e.g., bottles, drums)
D Hardware (e.g., valves, pipe, hoses)
D Pumps and related equipment
Describe the equipment and how it was being used by the suspects (if at all):
Unusual conditions at the site
Were there any unusual conditions at the site?
D Explosions or fires
D Dead/stressed vegetation
D Other
D Fogs or vapors
D Dead animals
D Yes
D No
D Unusual odors
D Unusual noises
Describe the site conditions:
18
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Additional observations
Describe any additional details from the witness account:
SIGNOFF
Name of interviewer:
Print name
Signature Date/Time:
Name of witness:
Print name
Signature Date/Time:
19 Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.6 Phone Threat Report Form
INSTRUCTIONS
This form is intended to be used by utility staff that regularly answer phone calls from the public (e.g., call
center operators). The purpose of this form is to help these staff capturer as much information from a
threatening phone call while the caller is on the line. It is important that the operator keep the caller on
the line as long as possible in order to collect additional information. Since this form will be used during
the call, it is important that operators become familiar with the content of the form. The sections of the
form are organized with the information that should be collected during the call at the front of the form
(i.e., Basic Call Information and Details of Threat) and information that can be completed immediately
following the call at the end of the form (i.e., the description of the caller). The information collected on
this form will be critical to the threat evaluation process.
Remember, tampering with a drinking water system is a crime under the SDWA Amendments!
THREAT NOTIFICATION
Name of person receiving the call:
Date phone call received:
Time phone call ended: _
Originating number:
Time phone call received:
Duration of phone call:
Originating name:
w w ^^^^^^^^^^^^^^_^^^^^^^^^^^^^^_ w w ^^^^^^^^^^^^^^_^^^^^^^^^^^^^^_
If the number/name is not displayed on the caller ID, press *57 (or call trace) at the end of the
call and inform law enforcement that the phone company may have trace information.
Is the connection clear?
D Yes
Could call be from a wireless phone? D Yes
DETAILS OF THREAT
Has the water already been contaminated?
Date and time of contaminant introduction known?
Date and time if known:
D No
D No
D Yes
D Yes
D No
D No
Location of contaminant introduction known?
Site Name:
D Yes
D No
Type of facility
D Source water D Treatment plant
D Ground storage tank D Elevated storage tank
D Distribution main D Hydrant
D Other
D Pump station
D Finished water reservoir
D Service connection
Address:
Additional Site Information:
20
Interim Final - August 2004
-------
Name or type of contaminant known?
Type of contaminant
D Chemical D Biological
Specific contaminant name/description:
RESPONSE GUIDELINES
D Yes D No
D Radiological
Mode of contaminant introduction known?
Method of addition: D Single dose
Amount of material:
D Yes D No
D Overtime D Other
Additional Information:
Motive for contamination known?
D Retaliation/revenge
D Other
D Yes
D Political cause
Describe motivation:
D No
D Religious doctrine
CALLER INFORMATION
Basic Information:
Stated name:
Affiliation:
Phone number: _
Location/address:
Caller's Voice:
Did the voice sound disguised or altered? D Yes
Did the call sound like a recording? D Yes
Did the voice sound? D Male / D Female
Did the voice sound familiar?
If 'Yes,' who did it sound like?
Did the caller have an accent?
If 'Yes,' what nationality?
How did the caller sound or speak?
D Educated
D Irrational
D Reading a script
D Yes
D Yes
D Well spoken
D Obscene
D Other
D No
D No
D Young / D Old
D No
D No
D Illiterate
D Incoherent
21
Interim Final - August 2004
-------
RESPONSE GUIDELINES
What was the caller's tone of voice?
D Calm D Angry D Lisping D Stuttering/broken
D Excited D Nervous D Sincere D Insincere
D Slow D Rapid D Normal D Slurred
D Soft D Loud D Nasal D Clearing throat
D Laughing D Crying D Clear D Deep breathing
D Deep D High D Raspy D Cracking
D Other
Were there background noises coming from the caller's end?
D Silence
D Voices describe
D Children describe
D Animals describe
D Factory sounds describe
D Office sounds describe
D Music describe
D Traffic/street sounds describe
D Airplanes describe
D Trains describe
D Ships or large boats describe
D Other:
SIGNOFF
Name of call recipient:
Print name
Signature Date/Time:
Name of person completing form (if different from call recipient):
Print name
Signature Date/Time:
22 Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.7 Written Threat Report Form
INSTRUCTIONS
The purpose of this form is to summarize significant information from a written threat received by a
drinking water utility. This form should be completed by the WUERM or an individual designated by
incident command to evaluate the written threat. The summary information provided in this form is
intended to support the threat evaluation process; however, the completed form is not a substitute for the
complete written threat, which may contain additional, significant details.
The written threat itself (e.g., the note, letter, e-mail message, etc.) may be considered evidence and thus
should be minimally handled (or not handled at all) and placed into a clean plastic bag to preserve any
forensic evidence.
Remember, tampering with a drinking water system is a crime under the SDWA Amendments!
SAFETY
A suspicious letter or package could pose a threat in and of itself, so caution should be exercised if such
packages are received. The US Postal Service has issued guidance when dealing with suspicious
packages (http://www.usps.com/news/2001/press/pr01 1022qsa.htm).
THREAT NOTIFICATION
Name of person receiving the written threat:
Person(s) to whom threat was addressed:
Date threat received: Time threat received:
How was the written threat received?
D US Postal service D Delivery service D Courier
D Fax D E-mail D Hand delivered
D Other
If mailed, is the return address listed? D Yes D No
If mailed, what is the date and location of the postmark?
If delivered, what was the service used (list any tracking numbers)?
If Faxed, what is the number of the sending fax?
If E-mailed, what is the e-mail address of sender?
If hand-delivered, who delivered the message?
23 Interim Final - August 2004
-------
RESPONSE GUIDELINES
DETAILS OF THREAT
Has the water already been contaminated? D Yes D No
Date and time of contaminant introduction known? D Yes D No
Date and time if known:
Location of contaminant introduction known? D Yes D No
Site Name:
Type of facility
D Source water D Treatment plant D Pump station
D Ground storage tank D Elevated storage tank D Finished water reservoir
D Distribution main D Hydrant D Service connection
D Other
Address:
Additional Site Information:
Name or type of contaminant known? D Yes D No
Type of contaminant
D Chemical D Biological D Radiological
Specific contaminant name/description:
Mode of contaminant introduction known? D Yes D No
Method of addition: D Single dose D Overtime D Other
Amount of material:
Additional Information:
Motive for contamination known? D Yes D No
D Retaliation/revenge D Political cause D Religious doctrine
D Other
Describe motivation:
NOTE CHARACTERISES
Perpetrator Information:
Stated name:
Affiliation:
Phone number: _
Location/address:
24 Interim Final - August 2004
-------
RESPONSE GUIDELINES
Condition of paper/envelop:
D Marked personal D Marked confidential D Properly addressed
D Neatly typed or written D Clean D Corrected or marked-up
D Crumpled or wadded up D Soiled/stained D Torn/tattered
D Other:
How was the note prepared?
D Handwritten in print D Handwritten in script D Computer typed
D Machine typed D Spliced (e.g., from other typed material)
D Other:
If handwritten, does writing look familiar? D Yes D No
Language:
D Clear English D Poor English
D Another language:
D Mixed languages:
Writing Style
D Educated D Proper grammar D Logical
D Uneducated D Poor grammar/spelling D Incoherent
D Use of slang D Obscene
D Other:
Writing Tone
D Clear D Direct D Sincere
D Condescending D Accusatory D Angry
D Agitated D Nervous D Irrational
D Other:
SIGNOFF
Name of individual who received the threat:
Print name
Signature Date/Time:
Name of person completing form (if different from written threat recipient):
Print name
Signature Date/Time:
25 Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.8 Water Quality/Consumer Complaint Report Form
INSTRUCTIONS
This form is provided to guide the individual responsible for evaluating unusual water quality data or
consumer complaints. It is designed to prompt the analyst to consider various factors or information
when evaluating the unusual data. The actual data used in this analysis should be compiled separately
and appended to this form. The form can be used to support the threat evaluation due to a threat warning
from unusual water quality or consumer complaints, or another type of threat warning in which water
quality data or consumer complaints are used to support the evaluation.
Note that in this form, water quality refers to both specific water quality parameters and the general
aesthetic characteristics of the water that might result in consumer complaints.
Threat warning is based on: D Water quality D Consumer complaints D Other
What is the water quality parameter or complaint under consideration?
Are unusual consumer complaints corroborated by unusual water quality data?
Is the unusual water quality indicative of a particular contaminant of concern? For example, is the
color, order, or taste associated with a particular contaminant?
Are consumers in the affected area experiencing any unusual health symptoms?
What is 'typical' for consumer complaints for the current season and water quality?
Number of complaints.
Nature of complaints.
Clustering of complaints
What is considered to be 'normal' water quality (i.e., what is the baseline water quality data or
level of consumer complaints)?
What is reliability of the method or instrumentation used for the water quality analysis?
Are standards and reagents OK?
Is the method/instrument functioning properly?
Based on recent data, does the unusual water quality appear to be part of a gradual trend (i.e.,
occurring over several days or longer)?
Are the unusual water quality observations sporadic over a wide area, or are they clustered in a
particular area?
What is the extent of the area? A pressure zone. A neighborhood. A city block. A street. A
building.
26 Interim Final - August 2004
-------
RESPONSE GUIDELINES
If the unusual condition isolated to a specific area:
Is this area being supplied by a particular plant or source water?
Have there been any operational changes at the plant or in the affected area of the system?
Has there been any flushing or distribution system maintenance in the affected area?
Has there been any repair or construction in the area that could impact water quality?
SIGNOFF
Name of person completing form:
Print name
Signature Date/Time:
27 Interim Final - August 2004
-------
RESPONSE GUIDELINES
2.9 Public Health Information Report Form
INSTRUCTIONS
The purpose of this form is to summarize significant information about a public health episode that could
be linked to contaminated water. This form should be completed by the WUERM or an individual
designated by incident command. The information compiled in this form is intended to support the threat
evaluation process.
In the case of a threat warning due to a report from public health, it is likely that the public health agency
will assume incident command during the investigation. The drinking water utility will likely play a support
role during the investigation, specifically to help determine whether or not water might be the cause.
PUBLIC HEALTH NOTIFICATION
Date and Time of notification:
Name of person who received the notification:
Contact information for individual providing the notification
Full Name:
Title:
Organization:
Address:
Day-time phone:
Evening phone:
Fax Number:
E-mail address:
Why is this person contacting the drinking water utility?
Has the state or local public health agency been notified? D Yes D No
If "No," the appropriate public health official should be immediately notified.
DESCRIPTION OF PUBLIC HEALTH EPISODE
Nature of public health episode:
D Unusual disease (mild) D Unusual disease (severe) D Death
D Other:
Symptoms:
D Diarrhea
D Fever
D Other:
D Vomiting/nausea
D Headache
D Flu-like symptoms
D Breathing difficulty
Describe symptoms:
Causative Agent: D Known D Suspected D Unknown
If known or suspected, provide additional detail below
D Chemical D Biological D Radiological
Describe
Estimate of time between exposure and onset of symptoms:
28 Interim Final - August 2004
-------
RESPONSE GUIDELINES
Exposed Individuals:
Location where exposure is thought to have occurred
D Residence D Work D School
D Restaurant D Shopping mall D Social gathering
D Other:
Additional notes on location of exposure:
Collect addresses for specific locations where exposure is thought to have occurred.
Is the pattern of exposure clustered in a specific area? D Yes D No
Extent of area
D Single building D Complex (several buildings) D City block
D Neighborhood D Cluster of neighborhoods D Large section of city
D Other:
Additional notes on extent of area:
Do the exposed individuals represent a disproportionate number of:
D Immune compromised D Elderly D Children
D Infants D Pregnant women D Women
D Other:
D None, no specific groups dominate the makeup of exposed individuals
EVALUATION OF LINK TO WATER
Are the symptoms consistent with typical waterborne diseases, such as gastrointestinal
disease, vomiting, or diarrhea? D Yes D No
Does the area of exposure coincide with a specific area of the system, such as a pressure
zone or area feed by a specific plant? D Yes D No
Were there any consumer complaints within the affected area? D Yes D No
Were there any unusual water quality data within the affected area? D Yes D No
Were there any process upsets or operational changes? D Yes D No
Was there any construction/maintenance within the affected area? D Yes D No
Were there any security incidents within the affected area? D Yes D No
SIGNOFF
Name of person completing form:
Print name
Signature Date/Time:
29 Interim Final - August 2004
-------
RESPONSE GUIDELINES
3 Site Characterization and Sampling
3.1 Site Characterization Process
Initial threat
evaluation
Threat is
'possible'
?OCESS
u_
Q.
Z
O
1-
D
UU
1-
THREA
/I -
V
Place samples in
secure storage
Customize the Site
Characterization Plan
Approaching the Site
Characterize the Site
Collect Sample
Exiting the Site
YES-
Ship samples to lab
Initial evaluation
Identify investigation site
Characterize site hazards
Develop sampling approach
Form site characterization team
Conduct field safety screening
Observe site conditions and
determine signs of hazard
Repeat field safety screening
Investigate site and evaluate
hazards
Conduct field water testing
30
Interim Final - August 2004
-------
RESPONSE GUIDELINES
3.2 Emergency Water Sample Collection Kit
Item Quantity
Notes
Field Resources and Documentation
Field guide
Health and safety plan
Sample labels
Sample documentation forms
Custody tape (or seals)
Chain of custody forms
Lab marker
2
2
48
24
2 rolls
24
2
Resource for field personnel
If required for the site
Waterproof (filled out in advance, if possible)
For recording sample information
Used on sample or shipping containers
For documenting sample custody
Waterproof, 1 red, 1 black
General Sampling Supplies
Sample containers
Device for grab sampling
10 liter HDPE container
Lab grade tape
Miscellaneous glassware
Collapsible cooler
Rigid shipping container
1 qt. zippered freezer bags
Thermometer
Paper towels
Table 3-2
1
4
3 rolls
N/A
1
1
1 packlOO
2
2 rolls
For collecting samples
For sampling large water bodies
For collection of large volume water samples
For temporary labeling in the field
Beakers, graduated cylinders, spatula, etc.
For sample storage
For shipping by overnight service if needed.
For double bagging ice and sample containers
For checking water temperature
Wiping wet containers and containing spills
Pathogen Sampling Supplies
Tubing and clamp
Stopwatch & graduated cylinder
Ultrafiltration apparatus
1
1
1
For sample tap flushing, etc.
For measuring flow rate
For concentrating pathogen samples
Reagents (may need to be kept separate from the rest of the kit)
Laboratory grade water
Sodium thiosulfate crystals
Ascorbic acid
Sodium sulfite crystals
Potassium dihydrogen citrate
6 Molar ACS grade hydrochloric
acid (HC1)
6 Molar trace metal-grade nitric
acid (HNO3)
1 0 Normal Sodium hydroxide
(NaOH)
pH paper in ranges from 0-4 and
10- 14
5 liters
1 00 grams
1 00 grams
1 00 grams
1 00 grams
25 mL
25 mL
25 mL
50 strips
For sample dilution in the field
For water sample dechlorination
For water sample dechlorination
For water sample dechlorination
For carbamate preservation
In dropper bottle for preservation of samples for
organic analyses
In dropper bottle for preservation of samples for
trace metals analysis
In dropper bottle for preservation of samples for
cyanide analyses
For checking the pH of samples preserved with
acid or base (sensitive to 0.5 pH units)
Safety Supplies
Splash resistant goggles
Disposable gloves
Disposable shoe covers
Disposable laboratory coats
Clear, heavy duty plastic trash bags
Rinse water
Antiseptic wipes
Bleach solution (at least 5%)
Squirt bottle
First aid kit
Flashlight/headlamp
2
6 pairs
2 pairs
2
4
20 liters
1 container
1 gallon
2
1
3
One per individual (minimum)
Nitrile or polyethylene, powder- free
One pair per individual (minimum)
One per individual (minimum)
For disposal of lab coat, gloves, etc.
For general use and first aid
For cleaning hands, sample containers, etc.
For decontamination if necessary
For use with rinse water or lab grade water
For general first aid
For working at night or in dark locations
31
Interim Final - August 2004
-------
C/5
Q
KH
O
O
OH
GO
W
Pi
Q)
.C
C
8
Q.
S
tf »^5
C ^3
II
^5 «
2§
Analytical
Technique
OJ
Preservati
M
e
v^
e
°c
S "e
3J M
Q <
d
Z
Container
Type
u.
OJ
c ^
0 N
U as
OJ
a.
H1
«
"a.
|
as
%
o>
'S
0>
H
o
^11
V (Establish
F 1
a
fij
u
as
(j
hH
as
pa
1
S-;
CHEMISTRY
Kl
o>
^^
e
'S
u.
o
ci
Tl-'
(N
"^ ^o
wS
P&T - GC/MS
(N
V
ffi
o g
ffi S
T! u
'o
ca
o
13
^H
Q
O
<[^
ci
(N
O
in pQ
^-* CS
W §
P&T-
GC/PID/ELCD
in
S
o
1)
f-i _ca
> u
t> 01
01 rg
S u
^S o
O ^H
S
o
Tl-
rH
'o
ri
m
o
CO
Kg
in t^
CS CS
in oo
SPE GC/MS
S
O -a
^H +^
> w
> o a
t> S cd
h-l
71
01
rH
'o
1)
oo
CN
ON
Tl-
in
O
h-l
PH
ffi
w
PH
oo
(N
ffi
a
o
+j
T3
Sulfuric ac:
w
+j
S ^
pi 0
^3 O
o -a
oo -5
Tl-
o £
Amber PVC
silanized gla:
h-l
<
Quarternary
nitrogen
compounds
(N
^H
en
in
O
C
HPLC-fluoresce
1) OO
cd en
^ i
^-* f
o o
Potassium
dihydrogen
sample pH
w
-M
S ^
pi 0
^3 O
o -a
oo -5
Tl-
s
o
1)
"~^ a
S 01
01 *rt
J 8
C1"} tS
h-i
o
Tl-
Carbamate
Pesticides
VI
+1
£^
a
Inorganic An;
oo
o
o
CN
oo
PH
O
hH
t^ ON
O O
o o
(N (N
oo
W
is
u
03 u
&^
S'o ;
ca ^3
III
£ -a a
u
o
^X",
(N
S"
Q
Is
c§ l)
h-l
S
in
(N
01
+" *
Metals/Elemel
^H (S|
in in
AA - cold vapoi
manual
AA - cold vapoi
automater
(N
VI
ffi
a
_o
2 °
.a s
iz oo
u
o
^X",
(N
Q
0 ^
to
rS ^
h-l
S
in
(N
o
Organometalli
compounds
(N
in
en
en
o
c
-C
Titrimetric
Spectrophotome
en
in
en
en
^
Colorimetric U\
3
1) O
§ "i
S S
'o u
3 CN
0 ffi
'o
o
IS
Q
o
01
<[^
(N
o
1
h-l
' '
1)
o"
M
rH
£^
oo
o
o
ON
Ol
01 ri
Gross alpha, gro
beta, gamma
isotopes, specifii
radionuclides
rH
ra
1
^^
1 &
S 8
S^
ll
u
o
^X",
(N
o
01
h-l
(N
O
'5b
'o
O
O
(N
1
(N
en
-------
GO
«
5
w
Q
B
w
GO
§
OH
GO
«
Pi
Reference
Methods
Analytical
Technique
Preservative
e
-B
a
^
a |
Q
e
3
e oj
0 N
U X
Sample Type
^-^
9
e
^
H
u.
o
-.
o
a.
rVl
CREEN
cc
Q
a
Q
Z
.S"
^
H
;»>
o
^
_o
"a.
a
8
^
is
-S
td
CREEN
cc
Q
a
Q
Z
>
Rapid toxicity asss
(several vendors)
O3
Consult
manufacturer
instructions.
03
13
b fH
^ t3 .2
^S tj
§ § F?
6 a .s
(N
O
h-l
(N
'o
'x
O
H
o
o
(N
I
13
OJ
-------
RESPONSE GUIDELINES
3.4 Sample Collection Guidelines
3.4.1 Safety Guidelines
1. Do not enter the site to perform sampling until cleared. Hazardous materials response
units may perform safety screening before allowing other responders to enter the site.
Note that field safety screening does not generally include testing for pathogens.
2. Do not eat, drink, or smoke at the site.
3. Do not taste or smell the water samples.
4. Do use general personal protective equipment (PPE) such as splash-proof goggles,
disposable gloves, proper footwear (i.e., no open toe or open heel shoes), a chemical
resistant, disposable lab coat, and long pants. (Note that this level of PPE is only
intended to minimize incidental contact with the water or chemical reagents used during
sample collection or field testing.)
5. Avoid all skin contact with the water, and if incidental contact does occur, immediately
flush the affected area with clean water brought to the site for that purpose.
6. Fill sampling containers slowly to avoid volatilization or aerosolization of contaminants.
7. Minimize the time that personnel are on the site and collecting samples.
3.4.2 Sampling Procedures
1. Pre-label sample containers with a waterproof marker. Information should include:
analyte class (pathogen, chemical, or radionuclide), specific analyte (if sample is being
collected for a specific target), sample identification number, utility name, location of
sample collection, sample collection date and time, and sampler's initials.
2. Check for the presence of any in-line filters (e.g., home treatment devices) that might
interfere with sampling. Remove such devices if present.
3. If the sample tap is the suspected point of contaminant introduction, collect swab samples
from the tap before flushing the tap and collecting water samples.
4. Flush sample taps for a time sufficient to displace the water in connecting lines in order
to obtain a sample that is representative of the water of interest. Keep the flow rate from
the sample tap sufficiently low in order to avoid splashing and aerosolizing water
droplets. Divert water to a drain if possible.
5. Carefully collect samples in the specified containers (see Section 3.3). If a reagent needs
to be added to the sample, allow enough headspace in the container to add the proper
amount of preservative. Cap then gently mix the contents to ensure that the reagent is
properly mixed with the sample. Test the sample with a strip of pH paper to ensure
preservation to the proper pH. Do not insert the pH paper into the sample container.
Pour a small portion of the mixed sample into the container cap then pour from the cap
onto the pH paper to verify
6. For chlorinated samples, VOCs should be collected into a secondary 8-oz. glass container
(prepared with ascorbic acid - see footnote 1, Table 3.3). Gently mix the sample and
transfer to 3, 40-ml VOA containers (triplicate). Fill the 40-ml container above the top to
form a meniscus. Close the container with the Teflon side of the septa facing the water
sample, gently invert the sample container several times, and verify that there are no air
bubbles in the container. Once each container is tagged, the three 40-ml containers
34 Interim Final - August 2004
-------
RESPONSE GUIDELINES
should be inserted into a plastic whirlpack bag (provided) and sealed prior to sample
storage.
7. Wipe the outside of the sealed containers with paper towel.
8. Attach custody seal to the sample container.
9. Place the sealed container into a rigid cooler and pack with frozen ice packs (preferred)
or scalable freezer bags filled with ice.
10. Tag each sample and record all necessary information on "Sample Documentation" and
"Chain of Custody" forms.
11. After all samples have been collected, preservative blanks and temperature blanks should
be prepared and tagged. A preservative blank should be prepared for each preservative
used during the sampling event. The preservative blank can be prepared by adding the
appropriate amount of preservative to the preservative blank containers, and tagging the
sample for the appropriate analysis (i.e., HNO3 preservative blank should be analyzed for
metals). Additionally, a temperature blank container should be placed in each cooler
containing samples.
3.4.3 Sample Holding
1. When samples are not in the possession of designated personnel, they should be secured
(e.g., locked in a secure area) and only accessible by designated personnel. In the field,
samples may need to be locked in a vehicle.
2. Samples should be chilled, but protected from freezing.
3. Samples should be held at the drinking water utility lab until shipped to a lab for analysis
or until it is determined that they are not needed.
4. Samples that are held longer than the approved holding times for contaminant analysis
may no longer be useful.
3.4.4 Sample Transport
1. Sample integrity and chain of custody must be maintained. All factors that might
compromise sample integrity (e.g., storage containers, excessive transit time,
temperature, pressure, physical disturbance, etc.) should be considered and appropriate
measures taken to avoid compromising samples.
2. Sample packaging must be in compliance with shipping regulations.
3. Samples may be screened by law enforcement and/or ICs prior to sample transport to the
laboratory.
4. Samples will be transported to the appropriate laboratory in coordination with law
enforcement using appropriate air and ground assets.
3 5 Interim Final - August 2004
-------
RESPONSE GUIDELINES
3.5 Site Characterization Plan Template
INSTRUCTIONS
This form is intended to support the development of a customized site characterization plan
developed in response to a specific water contamination threat. The incident commander and
site characterization team leader should develop this plan jointly if possible. The completed
form will be used to guide site characterization activities in the field; however, it may be
necessary to revise the initial plan based on initial observations at the site. A form should be
completed for each investigation site that will be characterized.
THREAT WARNING INFORMATION
Consult Module 2, Appendix 8.2 "Threat Evaluation Worksheet" for details about the
threat.
INVESTIGATION SITE
Site Name:
Type of facility:
D Source water
D Ground storage tank
reservoir
D Distribution main
D Other
D Treatment plant
D Elevated storage tank
D Hydrant
D Pump station
D Finished water
D Service connection
Address:
Additional Site Information:
INITIAL HAZARD ASSESSMENT
Are there any indicators of an explosive hazard? D Yes
If "Yes," notify law enforcement and do not send a team to the site.
D No
Initial hazard categorization
D Low hazard D Chemical hazard
D Radiological hazard D Biological hazard
If the initial hazard assessment indicates a chemical, radiological, or biological hazard
(as described in Module 3, Section 4.1.3), then only teams trained to deal with such
hazards should be sent to the site.
36
Interim Final - August 2004
-------
RESPONSE GUIDELINES
SITE CHARACTERIZATION TEAM
Name & Affiliation of Site Characterization Team Leader:
Drinking water utility staff:
D Water quality specialist Name:
D Security specialist Name:
D Operations specialist Name:
D Other Name:
Representatives from other agencies:
D Local law enforcement D Fire department
D US EPA D FBI
D HazMat
D Other
COMMUNICATION PROCEDURES
Mode of communication:
D Phone
D Facsimile
Reporting events:
D Upon arrival at site
D After site evaluation
D Other
D 2-way radio
D Other
D During approach
D After field testing
FIELD SCREENING CHECKLIST
D Digital
D Site entry
D Site exit
Parameter
Radiation
Chlorine residual
pH / conductivity
Cyanide
Volatile
chemicals
Chemical
weapons
Biotoxins
Pathogens
Screen
Both
Water
Water
Water
Safety
Both
Water
Water
Meter/Kit ID3
Check Date4
Reference Value
1. List the parameters that will be evaluated as part of field screening (examples are listed).
2. Screening may be conducted for safety, rapid water testing, or both.
3. Report the unique identifier for the meter or kit used during screening.
4. Report date of last calibration, last equipment check, or expiration date as appropriate.
5. List any reference value that would trigger a particular action, such as exiting the site.
37
Interim Final - August 2004
-------
RESPONSE GUIDELINES
SAMPLING CHECKLIST
Analyte
Standard VOCs
Semi-volatiles
Quartenary nitrogen
compounds
Cyanide
Carbamate pesticides
Metals/elements
Organometallic compounds
Cyanide
Radionuclides
Non-target VOCs
Non-target organic
compounds
Non-target inorganic
compounds
Immunoassays
Pathogens - culture
Pathogens - PCR
Water quality - bacteria
Water quality - chemistry
No.
Samples
Sample Preservation
1. List the parameters that will be sampled during site characterization (examples are
listed).
2. List preservatives and dechlorinating agents and indicate if they are to be added in the
field.
EQUIPMENT CHECKLIST
D Completed Site Characterization Plan
D Emergency Water Sampling Kit (Table 3-1)
D Reagents (if stored separately)
D Laboratory grade water (5 gal)
D Special equipment for the specific site
D Other
D Additional documentation
D Field Testing Kit (Table 3-3)
D Bags of ice or freezer packs
D Rinse water (20 liters)
D Disposable camera
38
Interim Final - August 2004
-------
RESPONSE GUIDELINES
SAMPLE HANDLING INSTRUCTIONS
Sample delivery:
D Return samples to water utility
D Ship samples to specified location
D Deliver samples to specified recipient (e.g., laboratory, law enforcement, shipping co.,
etc.)
Name of recipient:
Phone No.: Fax No.:
Delivery address:
Sample storage and security:
Describe any special precautions or instructions related to sample storage and security:
SIGNOFF
Incident Commander (or designee responsible for developing Site Characterization Plan):
Print name
Signature Date/Time:
Site Characterization Team Leader:
Print name
Signature Date/Time:
3 9 Interim Final - August 2004
-------
RESPONSE GUIDELINES
3.6 Site Characterization Report Form
INSTRUCTIONS
Members of the site characterization team can use this form to record their observations at the
investigation site. It also serves as a checklist for notifying incident command at key points
during the characterization. Additional checklists are included in this form for sample collection
and exiting the site. The completed form can also be used as a component of the site
characterization report. A form should be completed for each investigation site that is
characterized
GENERAL INFORMATION
Date: Time arrived investigation at site:
Name of Site Characterization Team Leader:
Phone No.: Fax No.:
LOCATION OF INVESTIGATION SITE
Site Name:
Type of facility:
D Source water D Treatment plant D Pump station
D Finished water reservoir D Elevated storage tank D Ground storage tank
D Distribution main D Hydrant D Service connection
D Other
Address:
Weather Conditions at Site:
Additional Site Information:
40 Interim Final - August 2004
-------
RESPONSE GUIDELINES
APPROACH TO SITE
Time of Approach to Site:
Initial Field Safety Screening (as listed in the "Site Characterization Plan"):
D None D Radiation D Volatile chemicals
D HAZCAT D Chemical weapons D Biological agents
D Other
Report results of field safety screening in Section 3.7 "Field Testing Results Form."
If any field safety screening result is above the corresponding reference value,
immediately notify incident command and do not proceed further into the site.
Initial Observation and Assessment of Immediate Hazards
D Unauthorized individuals present at the site
D Fire or other obvious hazard
D Signs of a potential explosive hazard (e.g., devices with exposed wires)
D Signs of a potential chemical hazard (e.g., dead animals, unusual fogs, unusual odors)
D Unusual and unexplained equipment at the site
D Other signs of immediate hazard
If there are any indicators of immediate hazard, immediately notify incident command
and do not proceed further into the site.
Report initial observations and results to incident commander.
Approval granted to proceed further into the site? D Yes D No
SITE INVESTIGATION
Time of Entry to Site:
Repeat Field Safety Screening
D None D Radiation D Volatile chemicals
D HAZCAT D Chemical weapons D Biological agents
D Other
Report results of field safety screening in Section 3.7 "Field Testing Results Form.'
If any field safety screening result is above the corresponding reference value,
immediately notify incident command and do not proceed further into the site.
Signs of Hazard:
D None D Unexplained dead animals
D Unexplained dead or stressed vegetation D Unexplained clouds or vapors
D Unexplained liquids D Other
Describe signs of hazard:
41 Interim Final - August 2004
-------
RESPONSE GUIDELINES
Unexplained or Unusual Odors:
D None
D Sulfur
D Sweet/Fruity
Describe unusual odor:
D Pungent
D Skunky
D New mown hay
D Irritating
D Bitter almond
D Other
Unusual Vehicles Found at the Site:
D Car/sedan D SUV
D Flatbed truck D Construction vehicle
D Other
D Pickup truck
D None
Describe vehicles (including make/model/year/color, license plate #, and logos or
markings):
Signs of Tampering:
D None
D Open/damaged gates, doors, or windows
D Missing/damaged equipment
D Other
D Cut locks/fences
D Open/damaged access hatches
D Facility in disarray
Signs of sequential intrusion (e.g., locks removed from a gate and hatch)?
D Yes D No
Describe signs of tampering:
Unusual Equipment:
D None
D Tools (e.g., wrenches, bolt cutters)
D Lab equipment (e.g., beakers, tubing)
D Other
D Discarded PPE (e.g., gloves, masks)
D Hardware (e.g., valves, pipe)
D Pumping equipment
Describe equipment:
42
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Unusual Containers:
Type of container:
D None
D Plastic bag
D Test Tube
Condition of container:
D Opened
D Unopened
Size of container:
D Drum/Barrel
D Box/Bin
D Bulk container
D New
D Old
Describe labeling on container:
D Bottle/Jar
D Pressurized cylinder
D Other
D Damaged/leaking
D Intact/dry
Describe visible contents of container:
Rapid Field Testing of the Water
D None D
D Cyanide D
D Pesticides D
D Other
Residual disinfectant
Radiation
Biotoxins
D pH / conductivity
D VOCsandSVOCs
D General toxicity
Report results of rapid field testing of the water in Section 3.7 "Field Testing Results
Form."
If any field test result is above the corresponding reference value, immediately notify
incident command and wait for instruction regarding how to proceed.
Report findings of site investigation to incident commander.
Approval granted to proceed with sample collection?
SAMPLING
Time Sampling was Initiated / Completed: /.
D Yes D No
Implement Sampling Procedures Appropriate for the Hazard Conditions at the Site:
D Low hazard D Chemical hazard
D Radiological hazard D Biological hazard
If the site is characterized as a chemical, radiological, or biological hazard, then special
sampling and safety procedures should be followed.
43
Interim Final - August 2004
-------
RESPONSE GUIDELINES
Safety Checklist:
D Do not eat, drink, or smoke at the site.
D Do not taste or smell the water samples.
D Do use the general PPE included in the emergency water sampling kit.
D Avoid all contact with the water, and flush immediately with clean water in the case
of contact.
D Slowly fill sample bottles to avoid volatilization and aerosolization.
D Minimize the time that personnel are on site and collecting samples.
General Sampling Guidelines:
D Properly label each sample bottle.
D Carefully flush sample taps prior to sample collection, if applicable.
D Collect samples according to method requirements (e.g., w/o headspace for VOCs).
D Add preservatives or dechlorinating agents as specified.
D Carefully close sample containers and verify that they don't leak.
D Wipe the outside of sample containers with a mild bleach solution if needed.
D Place sample containers into a scalable plastic bag.
D Place samples into an appropriate, rigid shipping container.
D Pack container with frozen ice packs.
D Complete "Sample Documentation Form" (Section 3.8).
D Complete "Chain of Custody Form" (Section 3.9).
D Secure shipping container with custody tape.
D Comply with any other sample security provisions required by participating agencies.
EXITING THE SITE
Time of Site Exit:
Site Exit Checklist
D Verify that hatches, locks, etc. are properly secured.
D Remove all samples, equipment, and materials from the site.
D Verify that all samples are in the cooler and properly seal the cooler.
D Remove all PPE at site perimeter.
D Place disposable PPE and other trash into a heavy-duty plastic trash bag.
D Verify that the perimeter has been properly secured before leaving the site.
D Ensure that all documentation has been completed before leaving the site perimeter.
D Comply with any site control measures required by participating agencies.
D Contact incident commander and inform them that the team is leaving the site.
SIGNOFF
Site Characterization Team Leader:
Print name
Signature Date/Time:
44 Interim Final - August 2004
-------
Q
KH
O
O
OH
GO
W
Pi
i
O)
c
CO
6
Z
e
o
JS
o-
**
*
^
«
H
2
.S
b-
«
E
Z
aj
?j
PN
O3
bi
e
H
2
"«
E
o
V
s
Q
vo
"08
1
l/^
^
3
^
wl-f.
c ^
'S a
L^
pH
"a
Q
«
s^
u
o
s
1
H
a
^a
+J HH
V
§
,_!
e
0>
X.
u
"8
'
-2
V
E
C3
08
o-
-d
N
Kj
OJ
O
ft
o
o
OJ
ts
o
OJ
OJ
^
O
d
Q
S3
ts
.3
.a> ll
^ b a «-> "
° M^ "^
.^g 3 ^ ^ 'S
^S -o c§ g '^^
il gxgig"
S *'~l ^ Irt
3 u & " ^
'& o -5 ^ ^ a
«3 "S *^ & u
^ +> *« S 1-1 «3
||li| e
jillli
llll.fl
U '^ 0 0 to °
1> 1> ?|~] ?|~] 1> g_>
TO* "3 o o Tl -i
g S 05 05 i^ g
3? o o o 3 "3
JJ ft ft ft 05 05
C/5 Pi Pi Pi Pi Pi
o
o
-------
Q
KH
O
o
OH
GO
W
Pi
i
£
C
O
c
o;
o
o
Q
Q>
I
-^J
Oj
^
1
c/l
5
"o
>~>
i
ed
"S
0>
1
c/l
ed
ffi
&
^
<4H
ed
^
rt
^
C/l
"S
W)
cj
&0
_g
^^
ed
'S
_O
S
c/l
_>
-J >
oj
§
VH
-j >
o
&
PH
^
o
o
-------
3.9 Chain of Custody Form
Site Name:
Sampler Phone No.:
Sample ID
Collection Date
Relinquished by:
Relinquished by:
Relinquished by:
Relinquished by:
Relinquished by:
Sampler:
Signature:
No. Bottles
Analysis
Received by: Date/time:
Received by: Date/time:
Received by: Date/time:
Received by: Date/time:
Received by: Date/time:
Dispatched by: Date/time: Received for Laboratory by: Date/time:
Method of Sample Transport:
Shipper: Phone No.: Tracking No.:
47
Interim Final - August 2004
-------
4 Sample Analysis
4.1 Laboratory Contact List
Analysis
Pathogens
Chemical
Chemical
Radiological
CW Agents
Laboratory
Physical Address
Contact Person
Phone
48
Interim Final - August 2004
-------
4.2 General Approach for Analysis of Unknowns in Water
Review the Site
Characterization Report
Contaminant class
nown or suspected''
Perform Screening for
Chemicals ant/Biologicals
Specific contaminant
tentatively identified?
Perform Screening for
Chemicals or Biologicals
Perform Confirmatory
Analysis
Presence of
contaminant
confirmed?
Is additional
screening
necessary?
Revise/Expand
Analytical Approach
YES-
Analysis Complete. \
Report Results. f
49
Interim Final - August 2004
-------
4.3 General Classes of Chemicals, Analyte Groups, and Example Contaminants
Chemical
types
Organic
Inorganic
Cyanides
Radionuclides
CW Agents
Analytical Group
Volatiles
Semivolatiles
Non- volatile s
Carbamate compounds
Quaternary nitrogen compounds
Pharmaceuticals
Trace metals
Nonmetals
Organometallics
Cyanides
Radiologicals
Schedule 1 only
Example Contaminants*
Acetone, acrylonitrile, chloroform, methyl ?-butyl ether,
tetrachloroethene, toluene,
Organophosphates (e.g., malathion, mevinphos, dichlorvos, etc.),
cyanazine, chlorinated insecticides, chlordane, pentachlorophenol
Sodium trifluroacetates, surfactants
Aldicarb, carbofuran, oxamyl
Diquat, paraquat
Nicotine, illicit drugs
Mercury, lead, cobalt
Arsenic salts
Organomercury compounds
Cyanide salts, cyanogen chloride
Cesium- 13 7, Cobalt-60, Strontium-92
(e.g., VX, sarin, nitrogen and sulfur mustards, Lewsites)
Not every contaminant in a particular analytical group is listed in this column.
4.4 General Classes of Pathogens, Specific Organisms, and Select Agent Status
Pathogen general class
Bacteria (non-spore forming)
Bacteria (spore forming)
Bacteria (Rickettsia)
Protozoa
Viruses
Organism
Brucella spp.
Burkholderia pseudomallerei
Campylobacter spp.
E. coli0157:H7
Francisella tularensis
Salmonella spp.
Shigella spp.
Vibrio cholerae
Yersinia pestis
Bacillus anthracis
Clostridium botulinum A
Coxiella burnetti
Cryptosporidium parvum
Entamoeba histolytica
Giardia intestinalis
Toxoplasma gondii
Enteroviruses
Hepatitis A
Hepatitis E
Noroviruses
Rotavirus
Variola
VEE
VHP
Select Agent*
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
* See http://www.cdc.gov/od/sap/docs/salist.pdf
50
Interim Final - August 2004
-------
5 Response Actions
5.1 Decision Tree for Containment Options
OR
Review existing information
Determine whether
the contaminated area
can be estimated
Estimate spread of
contaminant
Threat
is 'possible'
Determine whether
the contaminated area
can be contained
Threat is
'credible' or
'confirmed'
Determine whether
the impacts of containment
will be minimal
Develop and implement a
containment strategy
Develop and implement a
containment strategy
51
Interim Final - August 2004
-------
5.2 Decision Tree for Public Notification
Assess threat
credibility and public
health consequences
Evaluate ability of operational
response actions to provide
adequate public health protection
re operationa
response actions
adequate?
YES-
Public notification may
not be necessary
Consult with appropriate
officials regarding public
notification options
Is boiling
effective and
dvisable?
Is there a
risk of dermal or
inhalational
exposure?
-NO-
YES> Issue a "boil water" notice
NO->
Issue a "do not drink" notice
Consider alternate water
supply for consumption
Issue a "do not use" notice t
Consider alternate water
supply for consumption,
sanitation, and other uses
52
Interim Final - August 2004
-------
5.3 Contaminant Characterization and Transport Worksheet
INSTRUCTIONS
The purpose of this worksheet is to help organize information that will lead to the identification of the
contaminant to facilitate decisions on appropriate operational responses and provide more accurate
information for public communication/notification. Contaminant identification will most likely first be a
presumptive identification followed by more lengthy procedures to verify the identity of the contaminant.
While validated analytical results are typically the most reliable means of contaminant identification, other
information collected during the threat evaluation and site characterization may provide valuable
insight regarding the identity of the contaminant.
SITE CHARACTERIZATION/THREAT EVALUATION SUMMARY
Describe the contaminant's odor, if applicable.
Describe the reported taste of the contaminant, if applicable.
Caution: Do NOT taste the water.
What was the physical form of the contaminant?
D Solid D Liquid D Gas
D Slurry D Powder D Granules
D Other
What color was the contaminant?
Summarize additional information obtained during site characterization/threat warning that is relevant to
contaminant identification.
Summarize the on-line monitoring data, consumer complaints, or witness accounts that are relevant to
contaminant identification.
Field Analysis Summary
Summarize the results of the field analysis for the following parameters:
Radiation
Chlorine residual
pH, conductivity
Cyanide
Volatile chemicals _
Chemical weapons
Biotoxins
Pathogens
Other
53 Interim Final - August 2004
-------
Public Health Information
Have death or disease in the population been reported? D Yes D No D Unknown
Type/symptoms
Is there information on unusual sales of pharmaceutical supplies (e.g., diarrhea medication)?
Number of people affected
Number of fatalities
Location/area affected
Was an epidemiological investigation conducted? D Yes D No D Unknown
Results
Was a clinical investigation conducted? D Yes D No D Unknown
Results
Is the contaminant acutely toxic and what are the acute effects? D Yes D No D Unknown
Describe
LABORATORY ANALYSIS SUMMARY
Results of analysis
Reporting units
Analytical method
Minimum reporting level.
Precision (relative standard deviation).
QA/QC (e.g., recovery of matrix spikes, standard checks, etc.)
Summarize additional information obtained during laboratory analysis that is relevant to contaminant
identification.
54 Interim Final - August 2004
-------
CONTAMINANT CHARACTERISTICS
What is the class of the contaminant?
D Biological D Chemical
D Unknown
D Radiological
Can any conclusions regarding the contaminant properties be made? (Place an 'X' in the appropriate
column)
Is the contaminant susceptible to
disinfection or chemical oxidation?
Does the contaminant hydrolyze into
less toxic products?
Does the contaminant hydrolyze into
more toxic products?
What are pKa values for chemicals?
Is the contaminant water soluble?
Does the contaminant have a
discernable taste, odor, or color?
Is the contaminant volatile or semi-
volatile?
Does the contaminant impact the pH?
Does the contaminant impact
conductivity?
Does the contaminant impact other
water quality parameters?
Does the contaminant react with
certain disinfectants (i.e., chlorine,
chloramines, etc.)?
What is the contaminant's half life?
Yes
No
Unk
Comment/Additional Information
Contaminant Public Health Effect Information
What are the primary routes of exposure?
D Ingestion D Inhalation
D Unknown
D Dermal Contact
What are the acute health effects for the exposure routes identified?
What is the contaminant's LD5o/ID5o?
What is the length of time to first onset of symptoms after exposure?
What are the chronic health effects associated with exposure to the contaminant?
55
Interim Final - August 2004
-------
Does the contaminant have a method of secondary transmission?
D Yes D No D Unknown
Describe
Is an approach available to prevent undesirable health effects from the contaminant?
D Yes D No D Unknown
Describe
Are there treatments available for individuals exposed to the contaminant?
D Yes D No D Unknown
Describe
Are health standards for the contaminant available?
D Yes D No D Unknown
Describe
By which exposure route(s)?
D Ingestion D Inhalation
D Dermal D Ocular
List the levels for each exposure route.
Contaminant Treatment Information
Treatment Types
Lime softening
Reverse osmosis
Standard chlorination
Enhanced
chlorination
Standard filtration
Enhanced filtration
Membrane filtration
Nanofiltration
Electrodialysis
Cation exchange
resin
Anion exchange resin
Activated alumina
Chloramine
Chlorine dioxide
Standard UV
Enhanced UV
Standard ozone
Enhanced ozone
Standard GAG
Enhanced GAG
Standard air stripping
Enhanced air
stripping
Other Methods
Could be used to
treat the
contaminant?
Yes
Yes
Yes
Yes
H Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
Degradation products
formed as a consequence
of treatment
Rating of effectiveness
(poor, fair, good) of percent
effectiveness
56
Interim Final - August 2004
-------
Access to contaminant information (effects and properties)
In-house information
Contact/phone no.
Internal database
Public Health officials
Contact/phone no.
Web site/database
US EPA Water Contaminant Information Tool
Web site/access code
US EPA water contaminant information tool (WCIT).
US EPA's List of Drinking Water Contaminants & MCLs:
http://www.epa.gov/safewater/mcl.htmltfmcls.
Agency for Toxic Substances and Disease Registry (ATSDR): www.atsdr.cdc.gov.
CDC Emergency Preparedness and Response: www.bt.cdc.gov.
Recognizing Waterborne Disease and the Health Effects of Water Pollution: A Physician On-line
Reference Guide: www.WaterHealthConnection.org.
Physician Preparedness for Acts of Water Terrorism:
www.waterhealthconnection.org/bt/index.asp.
Registry of Toxic Effects of Chemical Substances (RTECS): www.cdc.gov/niosh/rtecs.html.
Risk Assessment Information System (RAIS), which contains information taken from US EPA's
Integrated Risk Information System (IRIS), the Health Effects Assessment Summary Tables
(HEAST-rad HEAST-nonrad), US EPA Peer Reviewed Toxicity Values (PRTVs) Database, and
other information sources: http://risk.lsd.ornl.gov/index.shtml.
United States Army Medical Research Institute of Infectious Diseases (USAMRIID) Medical
Management of Biological Casualties Handbook:
http://www.usamriid.armv.mil/education/bluebook.html.
WHO: www.who.int/search/en/.
WHO's "Public health response to biological and chemical weapons:"
www.who.int/csr/delibepidemics/biochemguide/en/index.html.
CONTAMINANT TRANSPORT
Summarize what is known regarding the location of contaminant introduction.
How much material was used [Ibs., tons, gal, etc.)
How was it added? D Single dose D Overtime D Unknown
Time period of suspected contaminant introduction.
Elapsed time.
Method of estimating the spread.
D Manual calculations D Hydraulic model D Water flow analysis
D CIS D Field analysis D Areas of customer complaints
D Areas of people with health-related symptoms
D Other
Estimate the contaminated area.
Estimate the population affected.
57 Interim Final - August 2004
-------
Identify any customers with special needs that are within the affected area.
D Critical Care Facilities
D Hospitals D Clinics
D Nursing Homes D Dialysis Centers
D Other
D Schools
D Day Care Facilities
D Businesses
D Food and Beverage Manufacturers D Commercial Ice Manufacturers
D Restaurants D Agricultural Operations
D Power Generation Facilities
D Other
SIGNOFF
Name of person completing form
Print name
Signature Date/Time:
5 8 Interim Final - August 2004
-------
5.4 Public Health Response Action Worksheet
INSTRUCTIONS
The purpose of this form is to help organize information to aid in the evaluation of containment options
and public notification options. The objectives of public health response actions (operational and public
notification) are to prevent or limit public exposure to potentially contaminated water by either restricting
further propagation of the contaminant through the distribution system or restricting use of the water
through public notification. This worksheet assumes that the "Contaminant Characterization and
Transport Worksheet" in Section 5.3 has been completed to the extent possible.
ASSESSMENT OF PUBLIC HEALTH IMPACT
Identity of the contaminant
Describe
D Suspected D Known
D Unknown
Contaminant properties (if known):
Toxic or infectious dose (LD5o/ID5o):
Route of exposure:
D Ingestion D Inhalation
D Other
D Dermal Contact
Symptoms of exposure to high dose:
Symptoms of exposure to low dose:
Other:
EVALUATION OF CONTAINMENT OPTIONS
Describe the location and extent of the contaminated area.
Containment options
D Valve closures
D Isolate zone(s)
D Other
D Reverse flow conditions
D By-pass
Critical equipment within contaminated area
D System equipment D Zones
D Hydrants D Other
D Pump stations
Customers with special needs within contaminated area
D Critical Care Facilities
D Hospitals
D Nursing Homes
D Other
Schools
D
D
Businesses
D Food and Beverage Manufacturers
D Restaurants
D Power Generation Facilities
D Other
D Clinics
D Dialysis Centers
D Commercial Ice Manufacturers
D Agricultural Operations
59
Interim Final - August 2004
-------
Effectiveness of containment options
D Complete contaminant isolation D Reduction in spread of contaminant
D Unknown D Other
Is containment expected to provide adequate public health protection?
D Yes D No D Unknown
Timeline for implementation of containment options
Containment procedures to begin:
Containment procedures to end:
EVALUATION OF PUBLIC NOTIFICATION OPTIONS
Is public notification necessary? D Yes D No
Collaboration Agencies (identified in Public Health Response Plan and Utility's ERP)
D Public health agencies D Police departments D Fire departments
D Hospitals/clinics D Laboratories D Drinking water primacy agency
D Regional Poison Control Center
D Other
Type of notification (Follow steps shown)
Is the contaminant known? D Yes D No
If no, issue a " Do Not Use" notice.
- If yes, is boiling effective and advisable? D Yes D No D Unknown
If yes, issue a "Boil Water" notice.
- - If no or unknown, is there a risk of dermal or inhalation exposure? D Yes D No D Unknown
If no, issue a "Do Not Drink" notice.
If yes or unknown, issue a " Do Not Use" notice.
Content of public notification
D Has the contamination incident been confirmed? D Yes D No
D Is the contaminant known? D Yes D No
D If yes, identity of the contaminant
D Characteristics of the contaminant
D Restrictions on use
D Ingestion exposure D Inhalation exposure D Dermal exposure
D Exposure symptoms
D Medical treatments
D Transmission mode (if biological)
D Duration of restriction
D Alternate water supply
D Additional instructions to consumers
D Other information about the incident
D Other
60 Interim Final - August 2004
-------
Notification to customers with special needs
D Critical Care Facilities
D Hospitals
D Nursing Homes
D Other
Schools
D Clinics
D Dialysis Centers
D
D
Businesses
D Food and Beverage Manufacturers
D Restaurants
D Power Generation Facilities
D Other
D Commercial Ice Manufacturers
D Agricultural Operations
Are there subpopulations that will be affected at a greater rate than general population?
D Yes D No D Unknown
Describe
Notification to consecutive system.
D Yes D No D Not Applicable
Method of dissemination
D Broadcast media (radio and television)
D Web site
D Newspaper
D Newsletters (water utility or partner organizations)
D Broadcast phone messages
D Posting in conspicuous locations
D Hand delivery
D Town hall meetings
D Other
D Government access channels
D Listserve email
D Letters by mail
D Phone banks
D Broadcast faxes
D Mass distribution through partners
D Door-to-door canvassing
D Conference calls
Notification/restriction timeline
Notification/restriction to begin: _
Notification/restriction to end:
ALTERNATE WATER SUPPLY NEEDS
Is an alternate water supply needed?
D Drinking water D Fire fighting
D Other
Where can customers obtain the alternate water supply?
D Bottled water provided by local government agencies
D Bottled water provided by local retailers
D Bulk water provided by certified water haulers
D Bulk water transported or provided by military assets
D Bulk water providing by neighboring water utilities
D Water treated at plant and hauled to distribution centers (i.e., in the case of distribution system
contamination)
D Other
61
Interim Final - August 2004
-------
What customers with special needs should be notified of the alternate water supply availability?
D Critical Care Facilities
D Hospitals D Clinics
D Nursing Homes D Dialysis Centers
D Other
D Schools
D Businesses
D Food and Beverage Manufacturers D Commercial Ice Manufacturers
D Restaurants D Agricultural Operations
D Power Generation Facilities
D Other
SIGNOFF
Name of person completing form
Print name
Signature Date/Time:
62 Interim Final - August 2004
-------
6 Appendices
6.1 Critical System Information Checklist
a Population Served and Service Connections
a Distribution Network Map (including pressure zones)
a Pressure Zone Map
a Treatment Process Flow Diagram
a Chlorination Stations (location and quantity of chlorine on site)
a Chemical Handling and/or Storage Facilities and Release Impact Analysis
a Booster Pump Stations (location, capacity, and power requirements)
a Supervisory Control and Data Acquisition systems
a Site Staffing Rosters and Employee's Duties and Responsibilities
a Vulnerability Assessments
a Backup Equipment and Power Generation
63 Interim Final - August 2004
-------
6.2 Information Resources
Agency for Toxic Substances and Disease Registry (ATSDR): www.atsdr.cdc.gov.
AOAC. 2003b. "Rapid Test Kits Test Kit Database"
http://www.aoac.org/testkits/TKDATA2.HTM.
CDC Emergency Preparedness and Response: www.bt.cdc.gov.
CDC. 2003f. "List of Select Biological Agents" http://www.cdc.gov/od/sap/docs/salist.pdf.
CWC. 2003b. "The Chemical Weapons Convention - A Quick Guide, CWC-002"
http://www.cwc.gov/lndustry Outreach/Publications/002/cwc-b0001 html.
FEMA, Hazardous Materials Guide for First Responders. http://www.usfa.fema.gov/fire-
service/hmgfr3.cfm
Physician Preparedness for Acts of Water Terrorism:
www.waterhealthconnection.org/bt/index.asp.
Recognizing Waterborne Disease and the Health Effects of Water Pollution: A Physician On-line
Reference Guide: www.waterhealthconnection.org.
Registry of Toxic Effects of Chemical Substances (RTECS): www.cdc.gov/niosh/rtecs.html.
Risk Assessment Information System (RAIS), which contains information taken from the US
EPA Integrated Risk Information System (IRIS), the Health Effects Assessment Summary Tables
(HEAST-rad HEAST-nonrad), US EPA Peer Reviewed Toxicity Values (PRTVs) Database, and
other information sources: http://risk.lsd.ornl.gov/index.shtml.
US Army Medical Research Institute of Infectious Diseases (USAMRIID) Medical Management
of Biological Casualties Handbook: http://www.usamriid.armv.mil/education/bluebook.html.
US Army. 2002. "Toxic Chemical Agent Safety Standards"
http://www.usapa.army.mil/pdffiles/p385 61.pdf.
US Coast Guard. 2001. "Chemical Hazards Response Information System"
http ://www. chrismanual. com.
US EPA's List of Drinking Water Contaminants & Maximum Contaminant Levels (MCLs):
http://www.epa.gov/safewater/mcl.htmltfmcls.
US EPA. 2000. "EPA Radiological Emergency Response Plan"
http://www.epa.gov/radiation/rert/docs/rerp-1 -OO.pdf.
US EPA. 2003c. "EPA Environmental Technology Verification Home" http://www.epa.gov/etv/.
US EPA. Undated c. Compendium of Environmental Testing Laboratories.
http ://www. epa. gov/compendium
US National Library of Medicine. 2001. Toxicology Tutor I - Basic Principles. May 14.
http://www.sis.nlm.nih.gov/ToxTutor/Toxl/al2.htm
WaterlSAC, which contains information on contaminants including various contaminant fact
sheets as well as the United Kingdom Water Industry Research (UKWIR) database:
www.waterisac.org.
WHO's "Public health response to biological and chemical weapons"
www.who.int/csr/delibepidemics/biochemguide/en/index.html.
WHO. 2001. "Health Aspects of Biological and Chemical Weapons"
http://www.who.int/emc/Ddfs/BIOWEAPONS FULL TEXT2.pdf
64 Interim Final - August 2004
-------
6.3 Threat Management Matrices
This section presents a "contamination threat management matrix" for each of the threat
warnings described in Section 2.2. Each matrix is a tabular summary that lists the following at
the 'possible,' 'credible,' and 'confirmatory' stages of the threat evaluation:
Information considered during the threat evaluation.
Factors considered during the threat evaluation.
Potential response actions.
6.3.1 Security Breach
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
Location of security breach.
Time of security breach.
Information from alarms.
Observations when security
breach was discovered.
Additional details from the
threat warning.
Was there an opportunity for
contamination?
Has normal operational
activity been ruled out?
Have other "harmless"
causes been ruled out?
Notifications within utility.
Local law enforcement
agencies.
Isolate affected area.
Initiate site characterization.
Estimate spread of suspected
contaminant.
Consult external information
sources.
Credible
Results of site characterization at
location of security breach.
Previous security incidents.
Real time water quality data from
the location of security breach.
Input from local law enforcement.
Do site characterization results
reveal signs of contamination?
Is this security breach similar to
previous security incidents?
Does other information (e.g.,
water quality) corroborate threat?
Does law enforcement consider
this a credible threat?
Drinking water primacy agency.
State/local public health agency.
FBI.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Analyze samples.
Perform site characterization at
additional investigation sites.
Confirmatory
Results of sample analysis.
Contaminant information.
Results of site characterization
at other investigation sites.
Input from primacy agency
and public health agency.
Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
Do site characterization results
reveal signs of contamination?
Is contamination indicated by a
"preponderance of evidence?"
Emergency response agencies.
National Response Center.
Other state and federal
assistance providers.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
Security breaches may be the most common type of threat warning encountered by a utility since
they may result from trespassing, vandalism, theft, or failure to re-secure facilities following
legitimate activities. The purpose of the threat evaluation under this scenario is to distinguish
between these more frequent, yet relatively harmless security breaches, and those few that might
be considered 'credible' contamination threats.
At the 'possible' stage of the threat evaluation, information about the security breach will be
available. Specifically, the location of the security breach will be known, which will likely be
established as the initial investigation site. Other information may be available from alarms
65
Interim Final - August 2004
-------
(including surveillance footage), which may help to establish the time of the security breach.
The evaluation at this stage should consider whether or not there was an opportunity for
contamination at the site of the security breach. Furthermore, "normal" activity should be
considered and investigated at this stage as a potential cause of the security breach (e.g., was a
utility crew recently at the site and potentially forgot to re-secure the area?). Potential response
actions to a 'possible' threat may include isolating areas of the system that could be affected,
initiating site characterization activities to collect more information in support of the threat
evaluation, and initiating the process to estimate the spread of the suspect water through the
system.
Information that may be available at the 'credible' stage includes the results of site
characterization, an assessment of previous security incidents, real-time water quality data in the
area of the security breach, and an assessment of the threat by law enforcement. The evaluation
at this stage will consider whether or not signs of contamination were discovered during site
characterization, including unusual results from field testing or unusual observations during the
site investigation. Consideration should also be given to whether or not the new information
available at this stage corroborates the information about the threat. If the threat is determined to
be 'credible,' response actions may include measures to limit or prevent exposure of the public to
the suspect water, such as public notification. Actions taken to continue the investigation at this
point may include analysis of samples collected from the site, continued site characterization
activities, and an analysis to estimate the spread of the contaminant.
The new information available at the confirmatory stage may include the results from laboratory
analysis, including QA/QC data to support the interpretation of the results. If a specific
contaminant is identified, then additional information about that contaminant can be used to
further evaluate the nature of the threat as well as implications to public health. The findings of
continued site characterization activities may also help to confirm the incident. The basis for
confirming a contamination incident can be analytical results that identify a specific contaminant
or other definitive evidence that a contaminant is present in the water. If a contaminant has been
identified, consideration should be given to the health effects associated with exposure to that
contaminant. It may be necessary to revise the sampling and analysis plans if a contaminant was
not positively identified through laboratory analysis but the threat is still deemed 'credible.'
Response actions potentially initiated once a contamination incident has been confirmed include
characterization of the contaminated area, revision to public health protection measures,
provision of alternate water supplies, and planning for remediation and recovery activities.
66 Interim Final - August 2004
-------
6.3.2 Witness Account
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
Location of the suspicious
activity.
Witness account of the
suspicious activity.
Additional details from the
threat warning.
Was there an opportunity for
contamination?
Is the witness reliable?
Has normal operational
activity been ruled out?
Have other "harmless"
causes been ruled out?
Notifications within utility.
Local law enforcement.
Isolate affected area.
Initiate site characterization.
Estimate spread of suspected
contaminant.
Consult external information
sources.
Interview witness for
additional information.
Credible
Additional information from the
witness.
Results of site characterization at
location of suspicious activity.
Previous security incidents.
Real time water quality data from
the location of suspicious activity.
Input from local law enforcement.
Do site characterization results
reveal signs of contamination?
Is the suspicious activity similar
to previous security incidents?
Does other information (e.g.,
water quality) corroborate threat?
Does law enforcement consider
this a credible threat?
Drinking water primacy agency.
State/local public health agency.
FBI.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Analyze samples.
Perform site characterization at
additional investigation sites.
Confirmatory
Results of sample analysis.
Contaminant information.
Results of site characterization
at other investigation sites.
Input from primacy agency
and public health agency.
Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
Do site characterization results
reveal signs of contamination?
Is contamination indicated by a
"preponderance of evidence?"
Emergency response agencies.
National Response Center.
Other state and federal
assistance providers.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
From the perspective of the threat management process, a threat triggered by a witness account is
similar to one triggered by a security breach. One of the few significant differences is the use of
information collected directly from the witness throughout the evaluation, particularly during the
'possible' and 'credible' stages of the threat evaluation. The reliability of the witness must be
considered when making these determinations, and additional evidence collected during the
investigation should be evaluated to determine whether or not it corroborates the witness
account.
67
Interim Final - August 2004
-------
6.3.3 Direct Notification by Perpetrator
08
I
,o
THREAT EVALUATION STAGE
Possible
Transcript of phone (or
written) threat.
The who, what, where,
when, and why of the threat.
Additional details from the
threat warning.
Vulnerability assessment.
Credible
Law enforcement assessment.
Primacy agency assessment.
Previous threats at this utility or
other utilities.
Results of site characterization at
selected investigation sites.
Real time water quality data.
Reports from ISAC, EPA, etc.
Confirmatory
FBI assessment.
Results of sample analysis.
Contaminant information.
Results of site characterization
at other investigation sites.
Input from primacy agency
and public health agency.
e
js
-^
es
"es
Is the threat feasible?
Has the water already been
contaminated?
Is the location known or
suspected?
Is the identity of the
perpetrator known or
suspected?
Have there been personnel
problems at the utility?
Do site characterization results
reveal signs of contamination?
Does other information (e.g.,
water quality) corroborate threat?
Does law enforcement consider
this a credible threat?
Does the primacy agency consider
this a credible threat?
Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
Do site characterization results
reveal signs of contamination?
Is contamination indicated by a
"preponderance of evidence?"
e
o
-B
es
Notifications within utility.
Local law enforcement.
Drinking water primacy
agency.
FBI.
State/local public health agency.
EPA Criminal Investigation
Division.
Emergency response agencies.
National Response Center.
Other state and federal
assistance providers.
e
o
a
Isolate affected area if
identified in the threat.
Identify sites and initiate site
characterization.
Consult external information
sources.
Gather information from law
enforcement assessment.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Analyze samples.
Perform site characterization at
additional investigation sites.
Estimate spread of suspected
contaminant.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
Threats to contaminate the water made via direct notification by a perpetrator need to be taken
seriously. However, the majority of such direct threats are hoaxes that may be intended to cause
panic or disruption, gain attention, or fulfill a personal vendetta. Thus, the focus of the threat
evaluation for this type of threat warning is to identify any credible threats amongst the larger
number of hoax notifications. In any case, direct threats against the water supply should be
reported to local law enforcement.
A key source of information that may support the threat evaluation under this scenario is
provided directly by the perpetrator making the threat. In the case of a phone threat, it is
important to collect information about the threat from the caller to support the threat evaluation.
Similarly, a written notification should be carefully reviewed for details about the threat.
Additional information collected throughout the investigation should be evaluated against the
details of the threat notification, and it corroborates the details of the notification, then the threat
is more likely to be deemed 'credible.'
Interim Final - August 2004
-------
One of the potential challenges in managing a threat triggered by direct notification from a
perpetrator is identification of an investigation site that will be the focus of site characterization
activities. Unless a location is named in the threat, it will be necessary to use other information,
such as that derived from vulnerability assessments or unusual water quality data/consumer
complaints, to identify investigation sites.
69 Interim Final - August 2004
-------
6.3.4 Unusual Water Quality or Consumer Complaints
Unusual Water Quality
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
Unusual water quality data.
Baseline water quality data.
Real time water quality data.
Operational information
corresponding to the time of
the unusual water quality.
Is the unusual water quality
significantly different from
an established baseline?
Could operational changes
be the cause?
Could changes in source
water quality be the cause?
Are there similar results at
other monitoring locations?
Notifications within utility.
Identify sites and initiate site
characterization.
Begin analysis of available
water quality data.
Investigate unusual
consumer complaints.
Consult external information
sources.
Credible
Results of site characterization at
selected investigation sites.
Previous threat warnings triggered
by water quality.
Contaminant information.
Reports of consumer complaints.
Do site characterization results
reveal signs of contamination?
Is this unusual data substantial
different from other water quality
episodes?
Is the unusual data indicative of a
specific contaminant?
Are the unusual water quality
clustered in a specific area?
Are there any unusual consumer
complaints in the area?
Drinking water primacy agency.
State/local public health agency.
Local law enforcement.
FBI.
Estimate affected area and isolate
if possible.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Analyze samples.
Perform site characterization at
additional investigation sites.
Confirmatory
Results of sample analysis.
Contaminant information.
Results of site characterization
at other investigation sites.
Input from primacy agency
and public health agency.
Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
Do site characterization results
reveal signs of contamination?
Is contamination indicated by a
"preponderance of evidence?"
Emergency response agencies.
National Response Center.
Other state and federal
assistance providers.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
Consumer Complaint
08
I
,o
THREAT EVALUATION STAGE
Possible
Compilation of consumer
complaints, including
geographic distribution.
Recent water quality data
that may be associated with
complaints.
Operational information
corresponding to the time of
the unusual complaints.
Credible
Results of site characterization at
selected investigation sites.
Summary of historic consumer
complaints.
Results of consumer interviews.
Contaminant information.
Confirmatory
Results of sample analysis.
Contaminant information.
Results of site characterization
at other investigation sites.
Input from primacy agency
and public health agency.
70
Interim Final - August 2004
-------
e
js
-^
es
3
"es
Are the complaints unusual?
Could operational changes
be the cause?
Could changes in source
water quality be the cause?
Are the complaints clustered
in a specific area?
Are complaints from
habitual complainers?
Do site characterization results
reveal signs of contamination?
Are other consumers in the area
experiencing similar water
quality?
Are the unusual complaints
significantly different from typical
complaints?
Are the complaints indicative of a
specific contaminant?
Is there anything unusual about
the water quality in the area?
Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
Do site characterization results
reveal signs of contamination?
Is contamination indicated by a
"preponderance of evidence?"
JS
-fcj
08
O
S
-fcj
o
Notifications within utility.
Drinking water primacy agency.
State/local public health agency.
Local law enforcement agency.
FBI.
Emergency response agencies.
National Response Center.
Other state and federal
assistance providers.
J-.
e
o
a
J-.
Identify sites and initiate site
characterization.
Begin analysis of available
water quality data.
Interview consumers in area
with high numbers of
complaints.
Consult external information
sources.
Estimate affected area and isolate
if possible.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Analyze samples.
Perform site characterization at
additional investigation sites.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
A threat warning arising from unusual water quality data is significantly different from the
other threat warnings previously discussed and thus should be handled differently during the
threat evaluation. In determining whether or not the threat is 'possible,' it is necessary to
evaluate the anomalous data relative to an established baseline. Furthermore, it is important to
consider operational conditions, or potential impacts from changing source water quality or
distribution system blending as possible explanations for the unusual water quality or complaint.
If the unusual water quality data is determined to be significantly different from the baseline, and
cannot be explained by other factors, then t contamination may be considered a possibility.
Presumably, the unusual water quality data will be associated with a particular location in the
system, which will help in the identification of investigation sites that will be the focus of site
characterization activities. At this stage, it is important to verify the anomalous water quality
data through additional testing using independent equipment. For example, if an incident was
triggered by a rapid decrease in the free chlorine residual, as detected by online electrochemical
monitors, additional testing could be performed with colormetric field kits to confirm the results.
Additional rapid field testing might also help to determine the bounds of the affected area.
Furthermore, specific information about particular contaminants should be considered at the
'credible' stage as it might be used to identify potential contaminants that would impact the
water quality parameter with anomalous readings. For example, contaminants with acidic
functional groups might result in reduced pH.
71
Interim Final - August 2004
-------
6.3.5 Notification by Public Health
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
Details of notification from
public health sector.
Symptoms of disease and
causative agent, if known.
Contaminant information.
Why is water under
investigation as a possible
source?
Are the reported symptoms
consistent with exposure to
the contaminant via water?
If causative agent is known,
is it stable in water?
Notifications within utility.
State/local public health
agency.
Drinking water primacy
agency.
Consult with public health
agency and primacy agency.
Consult external information
sources.
Credible
Geographic distribution of disease
or death.
Recent water quality and
operational data.
Reports of consumer complaints.
Contaminant information.
Is the geographic pattern of
exposure consistent with exposure
to contaminated water?
Is there a recent occurrence of
unusual water quality data or
consumer complaints?
Does additional information about
the potential contaminant indicate
water as a potential source?
FBI.
Local and State law enforcement
agencies.
Estimate affected area and isolate
if possible.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Identify sites and initiate site
characterization.
Analyze samples.
Confirmatory
Results of site characterization
at selected investigation sites.
Results of sample analysis.
Contaminant information.
FBI assessment.
Has the public health agency
concluded that water is the
cause of the disease or deaths?
Did sample analysis detect the
causative agent?
Was another contaminant
detected during sample
analysis that could be the cause
of the disease or deaths?
Emergency response agencies.
National Response Center.
Other state and federal
assistance providers.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
Notification from public health officials regarding a potential water contamination incident is
unique in that individuals have been exposed to a harmful substance resulting in illness, disease
or death in the population. The threat evaluation in this case may be part of a larger
epidemiological investigation to determine the cause of disease. It is critical that the utility work
with the appropriate public health officials from the outset, since these officials will likely have
information critical for the evaluation. For example, they may know or suspect the causative
agent based on clinical information. This knowledge, in conjunction with information about the
properties of the contaminant, may indicate whether or not contaminated water is even a
possibility. For example, if the causative agent is known to immediately break down into
harmless byproducts upon exposure to water, then the possibility of contaminated water might be
dismissed.
If water is considered a possible carrier for the contaminant, then further investigation should be
conducted to determine if water is the most likely carrier of the contaminant (i.e., analogous to
the 'credible' stage of the threat evaluation). Information that may help to make this
determination will include additional findings from the larger epidemiological investigation,
geographic distribution of exposure, recent water quality and operational data, and reports of
72
Interim Final - August 2004
-------
consumer complaints. If this additional information indicates that water contamination is likely,
response actions would likely include public notification and sampling for the contaminant. The
sampling plan developed at this point may start with information about the geographic
distribution of exposure; however, consideration must be given to the latency period of the
disease, which could be from minutes to weeks, as well as the travel time within the system. The
objectives of sampling and analysis at this point would include: 1) confirming the presence of the
contaminant in the water; 2) determining if the contaminant is still present; and 3) determining
the area affected. If water contamination is confirmed, and the contaminant is still present in the
system, it will be necessary to begin planning for remediation and recovery efforts. If the
contaminant is not found, extensive sampling would likely be necessary to demonstrate that the
contaminant is indeed absent from the system.
Office of Ground Water and Drinking Water
Water Security Division
EPA817-D-04-001
www. epa. gov/safewater/security
August 2004
73 Interim Final - August 2004
-------
Office of Ground Water and Drinking Water
Water Security Division
EPA817-D-04-001
www.epa.gov/safewater/security
August 2004 Printed on Recycled Paper
------- |